PT-2026-36999 · Eclipse Foundation · Eclipse Equinox Osgi

Published 2026-05-05 · Updated 2026-05-16 · CVE-2023-54344

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Equinox OSGi versions 3.7.2 and earlier

Description An issue allows unauthenticated attackers to execute arbitrary commands by sending payloads to the console interface. Attackers can connect to the OSGi console port and send base64-encoded bash commands wrapped in fork directives to achieve code execution and establish reverse shell connections.

Recommendations Update to a version later than 3.7.2.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-54344

Affected Products

Eclipse Equinox Osgi

References · 8

• 🔥 https://exploit-db.com/exploits/51879 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-54344 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-54344 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-54344 · Security Note
• https://ubuntu.com/security/CVE-2023-54344 · Vendor Advisory
• https://t.me/cveNotify/162157 · Telegram Post
• https://twitter.com/ADKCyber/status/2055761255571374403 · Twitter Post
• https://vulncheck.com/advisories/eclipse-equinox-osgi-remote-code-execution-via-console · Note